Google’s Threat Intelligence Group (GTIG) has issued a new report detailing the operational use of generative AI in offensive cyber operations by state-sponsored actors.
The new report observes that adversaries from North Korea, Iran, and China are no longer just using AI for productivity gains (like writing phishing emails) but are “experimenting with novel AI-enabled operations.”
The most significant development identified is the emergence of “AI-powered malware that can generate malicious scripts and change its code on the fly to bypass detection systems.” This “just-in-time AI” malware represents a significant evolution from traditional polymorphic malware, which merely changes its code to avoid signature-based detection.
This new class of malware appears to use generative AI to create entirely novel, bespoke attack scripts in real-time based on its target environment. It is, in effect, a “thinking” malware. In theory, such a tool could analyze an endpoint’s security defenses (like an EDR) and generate a payload specifically designed to circumvent them “on the fly.”
This development marks the shift of generative AI in hacking from a theoretical risk to an operational reality. It renders static, signature-based detection models completely obsolete and creates an urgent need for AI-powered defense tools that can detect malicious behavior and intent, rather than just matching signatures of known-bad code.
GTIG also noted that adversaries are using AI to pose as researchers or students in prompts to bypass AI safety guardrails and extract restricted information.
Sources: Google, PYMNTS, Infosecurity Magazine
—
By the ID Tech Editorial Team
